Search criteria
10 vulnerabilities found for HPE Aruba Networking EdgeConnect SD-WAN by Hewlett Packard Enterprise (HPE)
CVE-2024-41136 (GCVE-0-2024-41136)
Vulnerability from cvelistv5 – Published: 2024-07-24 20:05 – Updated: 2024-08-02 04:46
VLAI?
Summary
An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Severity ?
6.8 (Medium)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
Credits
Daniel Jensen (bugcrowd.com/dozernz)
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41136",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-25T13:17:26.089025Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:54:12.192Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:51.624Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n\u003cbr\u003e"
}
],
"value": "An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:05:42.905Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Command Injection in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41136",
"datePublished": "2024-07-24T20:05:42.905Z",
"dateReserved": "2024-07-15T21:54:25.878Z",
"dateUpdated": "2024-08-02T04:46:51.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41135 (GCVE-0-2024-41135)
Vulnerability from cvelistv5 – Published: 2024-07-24 20:03 – Updated: 2024-08-02 04:46
VLAI?
Summary
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise
Severity ?
7.2 (High)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
Credits
Daniel Jensen (bugcrowd.com/dozernz)
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41135",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-24T20:29:52.555289Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:54:59.908Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:52.383Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise\u003cbr\u003e"
}
],
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:03:45.603Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41135",
"datePublished": "2024-07-24T20:03:45.603Z",
"dateReserved": "2024-07-15T21:54:25.878Z",
"dateUpdated": "2024-08-02T04:46:52.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41134 (GCVE-0-2024-41134)
Vulnerability from cvelistv5 – Published: 2024-07-24 20:02 – Updated: 2024-08-02 04:46
VLAI?
Summary
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise
Severity ?
7.2 (High)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
Credits
Daniel Jensen (bugcrowd.com/dozernz)
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41134",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-25T14:32:38.222595Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T14:33:02.051Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:51.648Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise\u003cbr\u003e"
}
],
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:02:19.471Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41134",
"datePublished": "2024-07-24T20:02:19.471Z",
"dateReserved": "2024-07-15T21:54:25.877Z",
"dateUpdated": "2024-08-02T04:46:51.648Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41133 (GCVE-0-2024-41133)
Vulnerability from cvelistv5 – Published: 2024-07-24 20:00 – Updated: 2024-08-02 04:46
VLAI?
Summary
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise
Severity ?
7.2 (High)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
Credits
Daniel Jensen (bugcrowd.com/dozernz)
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41133",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-25T13:42:47.640104Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:53:41.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:52.469Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise\u003cbr\u003e"
}
],
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:00:19.562Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41133",
"datePublished": "2024-07-24T20:00:19.562Z",
"dateReserved": "2024-07-15T21:54:25.877Z",
"dateUpdated": "2024-08-02T04:46:52.469Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-33519 (GCVE-0-2024-33519)
Vulnerability from cvelistv5 – Published: 2024-07-24 19:57 – Updated: 2024-08-02 02:36
VLAI?
Summary
A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Severity ?
7.2 (High)
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
Credits
Daniel Jensen (bugcrowd.com/dozernz)
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-33519",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-24T20:23:42.569111Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:55:59.067Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:36:04.211Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise."
}
],
"value": "A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T19:57:27.110Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Server-Side prototype pollution Leading to Information Disclosure",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-33519",
"datePublished": "2024-07-24T19:57:27.110Z",
"dateReserved": "2024-04-23T14:21:30.435Z",
"dateUpdated": "2024-08-02T02:36:04.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41136 (GCVE-0-2024-41136)
Vulnerability from nvd – Published: 2024-07-24 20:05 – Updated: 2024-08-02 04:46
VLAI?
Summary
An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
Severity ?
6.8 (Medium)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
Credits
Daniel Jensen (bugcrowd.com/dozernz)
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41136",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-25T13:17:26.089025Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:54:12.192Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:51.624Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system.\n\n\u003cbr\u003e"
}
],
"value": "An authenticated command injection vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateways Command Line Interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:05:42.905Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Command Injection in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41136",
"datePublished": "2024-07-24T20:05:42.905Z",
"dateReserved": "2024-07-15T21:54:25.878Z",
"dateUpdated": "2024-08-02T04:46:51.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41135 (GCVE-0-2024-41135)
Vulnerability from nvd – Published: 2024-07-24 20:03 – Updated: 2024-08-02 04:46
VLAI?
Summary
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise
Severity ?
7.2 (High)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
Credits
Daniel Jensen (bugcrowd.com/dozernz)
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41135",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-24T20:29:52.555289Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:54:59.908Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:52.383Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise\u003cbr\u003e"
}
],
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:03:45.603Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41135",
"datePublished": "2024-07-24T20:03:45.603Z",
"dateReserved": "2024-07-15T21:54:25.878Z",
"dateUpdated": "2024-08-02T04:46:52.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41134 (GCVE-0-2024-41134)
Vulnerability from nvd – Published: 2024-07-24 20:02 – Updated: 2024-08-02 04:46
VLAI?
Summary
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise
Severity ?
7.2 (High)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
Credits
Daniel Jensen (bugcrowd.com/dozernz)
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41134",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-25T14:32:38.222595Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T14:33:02.051Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:51.648Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise\u003cbr\u003e"
}
],
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:02:19.471Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41134",
"datePublished": "2024-07-24T20:02:19.471Z",
"dateReserved": "2024-07-15T21:54:25.877Z",
"dateUpdated": "2024-08-02T04:46:51.648Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41133 (GCVE-0-2024-41133)
Vulnerability from nvd – Published: 2024-07-24 20:00 – Updated: 2024-08-02 04:46
VLAI?
Summary
A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise
Severity ?
7.2 (High)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
Credits
Daniel Jensen (bugcrowd.com/dozernz)
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41133",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-25T13:42:47.640104Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:53:41.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:46:52.469Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise\u003cbr\u003e"
}
],
"value": "A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway\u0027s Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as root on the underlying operating system leading to complete system compromise"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T20:00:19.562Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-41133",
"datePublished": "2024-07-24T20:00:19.562Z",
"dateReserved": "2024-07-15T21:54:25.877Z",
"dateUpdated": "2024-08-02T04:46:52.469Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-33519 (GCVE-0-2024-33519)
Vulnerability from nvd – Published: 2024-07-24 19:57 – Updated: 2024-08-02 02:36
VLAI?
Summary
A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Severity ?
7.2 (High)
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking EdgeConnect SD-WAN |
Affected:
ECOS 9.3.x.x: 9.3.3.0 and below , ≤ <=9.3.3.0
(semver)
Affected: ECOS 9.2.x.x: 9.2.9.0 and below , ≤ <=9.2.9.0 (semver) Affected: ECOS 9.1.x.x: 9.1.11.0 and below , ≤ <=9.1.11.0 (semver) Affected: ECOS 9.0.x.x: all builds are affected and are out of maintenance. , ≤ <=9.0.x.x (semver) Affected: ECOS 8.0.x.x: all builds are affected and are out of maintenance. , ≤ <=8.0.x.x (semver) |
Credits
Daniel Jensen (bugcrowd.com/dozernz)
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.3.3.0",
"status": "affected",
"version": "9.3.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.2.9.0",
"status": "affected",
"version": "9.2.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThanOrEqual": "9.1.11.0",
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:9.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:arubanetworks:edgeconnect_sd-wan_orchestrator:8.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "edgeconnect_sd-wan_orchestrator",
"vendor": "arubanetworks",
"versions": [
{
"lessThan": "8.0.1",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-33519",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-24T20:23:42.569111Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T13:55:59.067Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:36:04.211Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HPE Aruba Networking EdgeConnect SD-WAN",
"vendor": "Hewlett Packard Enterprise (HPE)",
"versions": [
{
"lessThanOrEqual": "\u003c=9.3.3.0",
"status": "affected",
"version": "ECOS 9.3.x.x: 9.3.3.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.2.9.0",
"status": "affected",
"version": "ECOS 9.2.x.x: 9.2.9.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.1.11.0",
"status": "affected",
"version": "ECOS 9.1.x.x: 9.1.11.0 and below",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=9.0.x.x",
"status": "affected",
"version": "ECOS 9.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
},
{
"lessThanOrEqual": "\u003c=8.0.x.x",
"status": "affected",
"version": "ECOS 8.0.x.x: all builds are affected and are out of maintenance.",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Daniel Jensen (bugcrowd.com/dozernz)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise."
}
],
"value": "A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T19:57:27.110Z",
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"shortName": "hpe"
},
"references": [
{
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"source": {
"advisory": "HPESBNW04673",
"discovery": "EXTERNAL"
},
"title": "Authenticated Server-Side prototype pollution Leading to Information Disclosure",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
"assignerShortName": "hpe",
"cveId": "CVE-2024-33519",
"datePublished": "2024-07-24T19:57:27.110Z",
"dateReserved": "2024-04-23T14:21:30.435Z",
"dateUpdated": "2024-08-02T02:36:04.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}